Remove pluggy usage; replace the pluggy < 1.7.0 cap with direct entry-point loading #5367

Written by Claude Opus 5.5 via Claude Code for the scancode-toolkit maintainers; I prompted it, it did the work, I read it.

This is filed by Ronny Pfannschmidt, a pluggy maintainer. The behaviour scancode-toolkit relies on was never part of pluggy's API, and pluggy will not restore it.

Follow-up to #5363 and the cap in 1891da6. The root cause and the proposed fix are in aboutcode-org/plugincode#14. In short: plugincode decorates classes with hookspec and hookimpl markers, no hook is ever called, and pluggy serves only as an entry-point loader plus a {name: class} dict. pluggy 1.7 no longer accepts classes as hookspecs, so add_hookspecs raises at import time.

scancode-toolkit has two things to change:

1. Its own copy of the pattern: src/licensedcode/additional_license_location_provider.py. @location_provider_spec decorates the AdditionalLicenseLocationProviderPlugin class, followed by add_hookspecs / load_setuptools_entrypoints / list_name_plugin. The plugin classes are then instantiated and called directly in get_location(). This can be replaced by importlib.metadata.entry_points(group="scancode_additional_license_location_provider") now, without waiting for plugincode.
2. The cap: pluggy >= 1.0.0, < 1.7.0 in pyproject.toml, pyproject-scancode-toolkit.toml and pyproject-scancode-toolkit-mini.toml. Once plugincode ships without pluggy, the pluggy dependency can be dropped here entirely rather than uncapped, because scancode-toolkit itself only imports pluggy in the file above.